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All known qudit-based prepare-and-measure quantum key distribution (PM-QKD) schemes are 
more error resilient than their qubit-based counterparts. Their high error resiliency comes partly 
from the careful encoding of multiple bits of signals used to generate the raw key in each transmitted 
qudit so that the same eavesdropping attempt causes a higher bit error rate (BER) in the raw key. 

Here I show that highly error-tolerant PM-QKD schemes can be constructed simply by encoding 
one bit of classical information in each transmitted qudit in the form (|i) ± \ j))/'/2, where |i)’s form 
an orthonormal basis of the 2"-dimensional Hilbert space. Moreover, I prove that these schemes 
can tolerate up to the theoretical maximum of 50% BER for n > 2 provided that the raw key 
is generated under a certain technical condition, making them the most error-tolerant PM-QKD 
schemes involving the transmission of unentangled finite-dimensional qudits to date. This shows the 
potential of processing quantum information using lower-dimensional quantum signals encoded in a 
higher-dimensional quantum state. 

PACS numbers: 03.67.Dd, 03.65.Aa, 89.70.-a 


Introduction — Quantum key distribution (QKD) al¬ 
lows two cooperative players, Alice and Bob, to share 
a secret key whose security is guaranteed by the laws 
of quantum mechanics. Since the discovery of the first 
QKD scheme by Bennett and Brassard [I|, researchers 
have been studying different aspects of QKD. New QKD 
protocols that are either more practical, efficient or error 
tolerant have been proposed. Actual QKD experiments 
for some of the protocols have been carried out. Uncondi¬ 
tionally security proofs, including those covering realistic 
settings like the use of imperfect sources and detectors, 
for many of these protocols have been found. (See, for 
example, the review article in Ref. 0 for an overview.) 

One line of research is to investigate the use of qu¬ 
dits rather than qubits as quantum information carri¬ 
ers in QKD. In particular, Chau proved the uncondi¬ 
tional security of a prepare-and-measure quantum key 
distribution (PM-QKD) scheme (called Chau05) using 
2"-dimensional quantum particles as information carri¬ 
ers each encoding n bits of the raw key Q- Although 
his scheme has a very low key rate and is hard to imple¬ 
ment using current technology, it can tolerate a bit error 
rate (BER) of up to 50% in the limit of n —>■ -l-oo 0. 
This demonstrates the superior error-tolerant capability 
of qudit-based PM-QKD scheme as the best qubit-based 
PM-QKD scheme known to date can only tolerate up to 
about 27.4% BER Recently, Sasaki et al. proposed a 
radically different qudit-based PM-QKD scheme known 
as the round-robin differential-phase-shift (RRDPS) pro¬ 
tocol in which Alice encodes multiple bits Si ’s in each of 
the A^-dimensional qudit state as 
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SO that Bob’s measurement can only reveal one of the 
{si — Sj)’s of his choice [^. This is a conceptually im¬ 
portant scheme for it demonstrates that the security of 
QKD needs not link to the Heisenberg uncertainty prin¬ 
ciple Q- In terms of performance, the RRDPS proto¬ 
col can also tolerate up to 50% BER in the N —i -boo 
limit. Besides, if the BER of the raw key is low, the key 
rate of the RRDPS protocol is much higher than that of 
Chau05. Several proof-of-principle experiments for the 
RRDPS protocol have been conducted [m 3 . 

Here I report a family of qudit-based PM-QKD 
schemes whose security comes from a new principle. In 
these schemes, Alice and Bob randomly and indepen¬ 
dently prepare and measure qubit-like states each in the 
form (|i) ± \j))/^/2 in a 2”-dimensional Hilbert space for 
n > 2 so that only one bit of the raw key is encoded and 
transmitted in the phase of each qudit state. (Here |i)’s 
form an orthonormal basis of the 2”-dimensional Hilbert 
space.) The security originates from the fact that the 
eavesdropper Eve has a hard time to read out a sizable 
portion of the raw key without being caught because 
she does not know the preparation basis of each qudit 
at the time when the quantum state is passing through 
the insecure channel under her control. By identifying 
|z) as the single photon state in the ith optical pulse, 
these schemes have the additional attractive feature that 
the prepared states, which are essentially qubit states in 
diagonal basis, can be easily created and measured us¬ 
ing a standard optical interferometer with variable path 
length. (Interestingly, the experimental techniques used 
to prepare quantum states in Expression (HD in Refs. [1- 
m can be adapted to prepare the states (|i) ± \ j))/y/2.) 
Using an aggressive entanglement distillation procedure 
involving local operation and two-way classical communi¬ 
cations (LOCC2) originally reported in Ref. Q, I prove 
that Alice and Bob could share a provably secure se¬ 
cret key whenever the BER is less than 50% provided 
that the raw key obeys the technical condition to be 
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stated in Eq. m later in the text, making it the first 
family of PM-QKD schemes that saturates the theoret¬ 
ical maximum limit of the tolerable BER using unen¬ 
tangled finite-dimensional quantum information carriers. 
This opens up the study of processing quantum informa¬ 
tion through the use of lower-dimensional quantum states 
embedded in a higher-dimensional Hilbert space or trans¬ 
ferred through a higher-dimensional quantum channel. 

The schemes — Let me denote the finite field of = 
2" elements by GF{N) and consider the following family 
of schemes. 

The family of PM-QKD schemes: 

1. Alice randomly picks i ^ j G GF{N). She secretly 
prepares a state in the form (|i)± |j))/-\/2 and sends 
it to Bob through an insecure quantum channel. 

2. Bob randomly picks i' ^ j' G GF{N) and measures 
the state along |i')± |j'). He keeps his measurement 
outcome private. 

3. By announcing the pairs {i,j) and (i',j') through 
an unjammable classical channel, Alice and Bob 
establish a bit of raw key from those states with 
(bj) = (*^/)■ (They adopt the convention that 
[H) + (“l)^li)]/v^ encodes the bit s.) They dis¬ 
card the measurement outcomes of those states 
with {i,j) ^ (*^/)• They repeat steps [TH3] until 
they have a long enough raw key. 

4. They estimate the BER of the raw key Cf,, namely, 
the fraction of mismatched bits in their shared raw 
bit string, by comparing (and then discarding) a 
small random sample of the raw key. Using both 
accepted and rejected measurement outcomes in 
step [3l they calculate the conditional probability 
Cc that a state is prepared and measured as (|i) ± 
\j))/\/2 given that it is prepared as (|f) ± \j))/\/2 
and measured as [|(1 —a)j-|-aj)± |(a-|-l)j —aj)]/-\/2 
for some G GF{N). (Note that all arithmetic 
in the state-ket of a qudit is performed in the finite 
field GF(N) from now on.) They continue only if 


(b) Alice and Bob randomly group their corre¬ 
sponding bits in their remaining raw key in 
sets each containing r bits. They replace each 
set by the parity of the r bits in the set. 

(c) Alice and Bob obtain their final secret key by 
applying the Shor-Preskill privacy amplifica¬ 
tion procedure I, ini to these bits using a 
Calderbank-Shor-Steane code that could cor¬ 
rect up to, say, 1% quantum error. 

Note that for the case of = 4, the above scheme 
takes a rather simple form. Alice and Bob keep those 
states that are prepared and measured in diagonal basis 
of the same Hilbert subspace Hij = span(|*), |j)) for some 
i ^ j G GF{i). In addition, Cc equals the length of 
the raw key divided by the total number of qudits that 
are prepared in the subspace Hij and measured in either 
Hij or Hab subspaces, where i, j, a, b are the four distinct 
elements of GF{4). 

The unconditional security proof — Now I show the 
unconditional security [i2)[l3l of this family of PM-QKD 
schemes for A^ > 4 by proving the unconditional secu¬ 
rity of the following associated family of entanglement- 
distillation-based quantum key distribution (E D-Q KD) 
protocols using the Shor-Preskill-type argument [ll|. 

The associated family of ED-QKD protocols: 

1 . Alice prepares the state 

randomly picks X,(3 G GF{N) with A ^ 0 and ap¬ 
plies the linear transformation 

L\/ 3 \a) = \Xa + f3) (3) 

for all a G GF{N) to the second qudit. She keeps 
the first qudit and sends the second qudit to Bob 
through an insecure quantum channel. 

2. Bob randomly picks A',/3' G GF{N) with A' ^ 0 
and applies to the qudit he received from Al¬ 
ice. Then, Alice and Bob projectively measure their 
shared state along the basis 


C-bCc -\~ 
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5. Alice and Bob apply the following LOCC2 classical 
post-processing procedure to the remaining raw key 
adapted from Ref. @ . The values of the parameters 
k and r used in this procedure will be discussed in 
Methods. 

(a) Alice and Bob randomly group their cor¬ 
responding bits in their remaining raw key 
in pairs. They reveal the parity of each 
corresponding pair and keep the first bit 
in those corresponding pairs whose parities 
agree. They repeat this process k times. 


B = {\'itae)-aGGF{N),eGGF{2)}, (4) 

where = [|0, a)-f (-1)^|1, a-f l)]/2. They 

keep those states in the form with k G GF{2) 
(which are regarded as qubit pairs from now on) 
provided that A = A', /3 = /3'. They repeat steps [1]- 
[2] until they have enough number of shared qubits. 


3. Let Cal be the conditional probability that the joint 
measurement outcome in step O is given that 

A = A' and p = (3'. They continue only if 

eoi + eii-I-(A^ - l)(eio-f eii) < i. (5) 
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4. Alice and Bob perform the following entanglement 
purification procedure adapted from Ref. Q- 

(a) They randomly group their corresponding 

qubits in tetrads where each tetrad consists 
of two pairs shared by them. Alice applies 
the unitary operation i—>■ to 

her share of the particles in the tetrad, where 
|'0 k) = [|0) + {—lY\\)]/\/2\ and Bob does 
the same to his corresponding particles in the 
tetrad. Alice and Bob keep their second qubit 
pair if the measurement results of their first 
qubit pair in the diagonal basis = {'0Oi 
agree. They repeat this process k times. 

(b) They randomly group their remaining qubits 
in sets each with r shared qubit pairs. They 
separately apply the [r, l,r] majority-vote er¬ 
ror correction code for the rectilinear basis to 
their share of the qubits in each set. 

(c) They apply a Calderbank-Shor-Steane code 
that could correct up to 1% quantum error to 
the remaining shared quantum state to distill 
out almost perfect I'I'oo) EPR pairs. Finally, 
by measuring each qubit of these states along 
the diagonal basis Alice and Bob obtain 
their secret key. 

Clearly = (/®X„zO|^oo) where 


I now proceed to analyze the security of the ED- 
QKD protocol. Clearly, the probabilities Caf’s obeys 
J2aGGF(N),e(^GF{2) = 1- Since A and j3 are randomly 
chosen for each transmitted qudit and are unknown to 
Eve during the transmission, Eq. © implies that 

CaO + Cal = Cbo + ^bl (8) 

for all non-zero a, & G GF{N). So, if Eq. ([S]) is satisfied. 
Coo > 1/2 is the greatest element among the Caf’s. Fur¬ 
thermore, by comparing the definitions of Cb, Cc in stepH] 
of the PM-QKD schemes with the definitions of Cq^’s in 
stepOof the ED-QKD protocols, I find the following cor¬ 
respondences: 


&b^c — (coi + eii). 

(9) 

Cc = eoo + eio + eoi -I- en 

(10) 

— Cc = (eio -f eii)(iV — 2). 

(11) 


Thus, Eq. ([5]) implies Eq. ®. 

The probabilities that the joint measurement outcomes 
for those remaining shared qubits just before step S] of the 
ED-QKD protocol can be written as the elements of the 
2x2 error matrix 

fpi feoo eoi\ 

\Px PyJ ~ ec Veio eiij ' ^ ^ 


Xa\b) = \a + b) and Z|6) = (6) 

for all b G GF{N). Here M{b) = b^~^ is the norm of 
b [l3|- Note that N{0) = 0 and 7V(&) = 1 if 6 ^ 0. 
Consider the expression 

{I ® L-^XaZ^Lxi3)\'i>bY 

= + b +X~^a) (7) 

i/eGF(2) 

for all A 7 ^: 0,/3, a, & G GF{N) and £, k G GF{2). Up to 
an irrelevant global phase, the R.H.S. of Eq. © equals 
|4'b+A-ia,K')- Here k' = /t if £ = 0 or J\f{\b + fi) = 
J\f{X{b -I- 1) -I- /3); and k' = k + 1 otherwise. Hence, the 
sequences of probabilities of measurement outcome along 
B conditioned on different A = A' and /3 = /3' in step [2] of 
the ED-QKD protocol transform from one to another by 
permutation. In addition, all operations in step U except 
the final measurement in the diagonal basis permute el¬ 
ements in B up to an irrelevant phase. Therefore, Alice 
(Bob) may push the final measurement in in ste p 1^ 
forward in time to immediately after step [U ([1]) [ 1 , Il5l|. 
By renaming X = j — i and /3 = i, I get Ta/ 3|0) = |f) 
and L\is\l) = |j). Consequently, this ED-QKD protocol 
is reduced to the PM-QKD scheme. Furthermore, the 
Shor-Preskill argument implies that the unconditional se¬ 
curity of the above PM-QKD scheme follows that of the 
ED-QKD protocol 0. 


By treating each pair of shared qudits as shared qubit 
pair, then pi, px, Py and Pz can be regarded as the prob¬ 
abilities that Bob’s share of the qubit pair has suffered 
/, Ux <Jy and az errors, respectively. 

Note that in the above ED-QKD protocol, step |4] is 
analogous to a similar procedure in Ref. @ with the roles 
of X- and Z-errors being swapped. That is to say, steoHal 
is a variation of the BXOR test Bill that reduces the 
Z-error of the resultant qubit pairs; whereas step |4b] re¬ 
duces the A-error. Applying Proposition 1 in Ref. Q 
with the roles of X- and Z-errors exchanged, the corre¬ 
sponding error matrix for the shared qubits immediately 
after step |4a| equals 


/ feEP 


1 

(A + B 

G + D\ 



2{A + G) 

\A-B 

G-D) 


where A = {pi +Px)‘^\ B = {pi - PxY\ G = {py +PzY'^ 
and D = {py — pzY ■ Since eoo > 1/2, so is p/. Hence 
from Proposition 2 in Ref. @ (again with X- and Z-errors 
exchanged), the quantum error rate of the shared qubits 
can be reduced to less than 1% after step|4b]and therefore 
almost perfect |'I>oo)’s can be distilled in stepH^if the r in 
step l4bl equals 0.005/(py^^ +P^^) and 2r(l/2 —p^^ — 
p^^Y ^ 1- Such an r exists if (H+D)^ 400C'(A-|-C'). 

Since pi > 1/2, pi — Pz > Px — Py Thus, r exists by 
picking a sufficiently large k as long as 

{Pl-Pxf > {Pl+Px){PyFPz)- 


(14) 
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(Incidentally, the same condition has been proven in 
Ref. for the special case oi = Py = Pz-) From 
Eqs. ® and m plus the fact that eoo + eb^c + (N — 
1)(1 — ec)/{N — 2 ) — eii = 1 , the sufficient condition for 
the existence of r can be rewritten as 


/(eb, Cc, eii) 


1 G-hG-c 


N{1 - ec) 

N-2 


2 


+ 2eii 


- eb(l - eb)e^ > 0. (15) 


The maximum tolerable BER emax of the ED- 
QKD protocol and hence the PM-QKD scheme is 
the largest possible Cf, provided that the parameters 
66 , Gc, 611 pass the test in step [3] of the ED-QKD 
protocol. That is, e„iax = sup{eb: /(e 6 ,ec,eii) > 
0 for all Cc, 611 with (cb, 6 c, 611 ) G TZ}, where TZ = 
{(Cb, Gc, 6 ll) e [0, 1]^: GbGc + (A^ - 1)(1 - Gc)/{N - 2) < 
1/2}. Since / is quadratic in Cb, Gc and en, the value 
of Cniax can be calculated readily. Specifically, elements 
in TZ obey 1 — GbGc — N{1 — Gc)/{N — 2) >0. So, 
f{Gb,Gc,Gii) > /(eb,ec,0) for all (eb,ec,eii) e TZ. More¬ 
over, for any fixed Cb G [0,1/2) and by varying Gc in TZ, 
it is straightforward to see that /(cb, Cc, 0) is minimized 
when Gc = e*(eb) = N/[2{N — 1 — {N — 2)eb]. Finally, 
it is easy to check that /(cb, 6 *(eb), 0 ) > 0 if and only 
if Gb G [0,1/2) provided that iV > 4. In summary, for 
(eb,ec,eii) e TZ, /(eb, 6 c, en) > 0 whenever Gb < 1/2. 
Besides, / —>■ 0 as en = 0, Gb ^ 1/2 and ec —>■ 1. There¬ 
fore, Omax = 1/2; and this can be attained when Eve 
feeds every particle sent by Alice through a completely 
dephasing channel before giving it to Bob. 

By the standard composability definition of security for 
QKD [il,[i3, the family of ED-QKD protocols for iV > 4 
can, therefore, produce a shared secret key whenever the 
BER is less then 50%. 

To conclude, using the above family of PM-QKD 
schemes, Alice and Bob can establish a secure key when¬ 


ever the BER of the raw key is less than 50% pro¬ 
vided that N > i and the accepted data rate Gc obeys 
Eq. ([2]). Since it is impossible to recover any encoded 
classical message after sending through a binary sym¬ 
metric channel with crossover probability 1 / 2 , this family 
of PM-QKD schemes shows that the most error-tolerant 
QKD scheme (as measured by its tolerable BER) can 
be constructed by sending 4-dimensional qubit-like qu- 
dits each containing a single bit of classical informa¬ 
tion encoded in its phase. (The most error-tolerant 
scheme of this type using 4-dimensional qudits before 
this study was Chau05, which can distill a secret key up 
to 35.6% BER.) The security of this family of schemes 
comes partly from the ability to deduce the A-error rate 
through a clever use of the accepted data rate Gc in step 01 
This opens up new possibilities for doing quantum infor¬ 
mation processing through carefully designed algorithms 
that sends lower-dimensional quantum states through a 
higher-dimensional channel. 

Outlook — So far, the analysis is restricted to the case 
of ideal source and detectors in the arbitrarily long raw 
key length limit. One still needs to investigate of the 
security and performance of this family of schemes for 
realistic source (say, by decoy state method [isl - l^ ') and 
detector (say by measurement-device-independent tech¬ 
niques [UIIjI) in the finite-key-length setting (23 - [2^ us¬ 
ing one-way or two-way classical post-processing. They 
will be reported elsewhere. 
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